VyOS 1.2.9 maintenance release

daniil@sentrium.io (Daniil Baturin) — Fri, 02 Dec 2022 05:00:00 GMT

Hello, Community!

VyOS 1.2.9, the last planned maintenance release of the Crux branch, is now available for subscribers to download. This marks the end of the GA phase for 1.2.x: we will only make any new releases if remotely-exploitable vulnerabilities are found in its code.

We encourage everyone to migrate to VyOS 1.3.x, and we are happy to help with it if needed.

VyOS Project July 2022 Update

daniil@sentrium.io (Daniil Baturin) — Tue, 30 Aug 2022 05:59:08 GMT

Hello, Community!

It is time for a new update! The most important news this time includes FRR upgrade to the latest stable version 8.3, RADIUS QoS attribute support improvements, a default log option for a zone-based firewall, and more. Read on for details!

A VyOS 1.2.0-alpha image with FRR instead of Quagga is available for testing (and we've found a GPL violation in VyOS)

daniil@sentrium.io (Daniil Baturin) — Wed, 01 Nov 2017 23:49:11 GMT

FreeRangeRouting

Now that 1.1.8 release candidate is out and is (hopefully) being tested by community members, we can get back to building the future of VyOS.

It's been obvious that Quagga needs a replacement, and, since we've been using a Quagga fork inherited from Vyatta Core that includes features that never made it to the mainline quagga, even more so. The mainline Quagga still doesn't have usable commands for configuring multiple routing tables, nor they seem to actively accept patches that would be OS-specific.

The options were discussed many times and so far it seems FreeRangeRouting is the best option. It's a fork of Quagga that is being actively developed, actively accepts contributions, and already includes a number of features that Quagga lacks, such as support for network namespaces, PIM-SM, working IS-IS and more. There's also work being done on non-disruptive config reload.

While FRR is more or less a drop-in replacement for Quagga, it's not identical, and many CLI adjustments will be needed to make VyOS work with it. It needs a lot of testing. For this I've built a custom image that has vyatta-quagga replaced with FRR.

You can download the image here: http://dev.packages.vyos.net/tmp/vyos-1.2.0-alpha-frr-test.iso Please test it and report any issues in the routing protocols configuration you find. It's obviously experimental and you shouldn't use it in real routers, the best way to test is to load your production configs into test virtual machines.

GPL violation

Now to the GPL violation we've found. That violation in fact has been there for over five years and no one noticed it! Then again, it's relatively indirect and subtle.

Quagga is licensed under GPL (and so is FRR). In Vyatta/VyOS, Quagga has been built with SNMP support, so it links with net-snmp. In turn, net-snmp is built with SSL support and links with OpenSSL. This is where the problem is, OpenSSL is licensed under a four-clause BSD license that is not compatible with GPL.

Sadly, there is no easy way out, so it will take some time to fix this violation. The options are:

Build Quagga/FRR without SNMP support, which means routing protocol data will not be available through SNMP
Build net-snmp without SSL support, which means SNMPv3 will stop working
Patch net-snmp to support another cryptographic library that is GPL-compatible

The third option is hardest to implement, but it's the most appealing of all since all functionality will be preserved. We'd like to hear your suggestions regarding the libraries that would be license compatible and that can co-exist with OpenSSL.

VyOS - Blog

VyOS 1.2.9 maintenance release

VyOS Project July 2022 Update

A VyOS 1.2.0-alpha image with FRR instead of Quagga is available for testing (and we've found a GPL violation in VyOS)

FreeRangeRouting

GPL violation